Authority-Concentration Review & Decentralisation Safeguards

Control objective

Authority-Concentration Review & Decentralisation Safeguards checks that no single AI agent holds end-to-end authority over a critical decision and that binding decisions are subject to separation of duties. This matters in BFSI because an agentic pipeline that can, on its own, originate, approve, and execute a high-impact action (releasing funds, approving a loan, closing an account) creates a concentrated point of failure or abuse with no independent check. There is no numeric metric or formula for this control; it is enforced structurally. To implement it, map each critical workflow, identify where binding decisions occur, and design the agent architecture so that distinct steps (proposal, approval, execution) are handled by separate agents or by an agent plus an independent human/control, with the segregation recorded and reviewed periodically. Evidence to log includes the decision-authority map, the separation-of-duties configuration, and review sign-offs. The threshold is that separation of duties is enforced on binding decisions and that no single agent holds end-to-end critical authority. A breach — any single agent able to complete a critical decision unchecked — should trigger redesign to insert an independent approval or human checkpoint before the capability is permitted in production.